-
-
Notifications
You must be signed in to change notification settings - Fork 6.2k
Update document to use FHS /usr/local/bin/gitea instead of /app/... for Docker
#19794
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -389,16 +389,6 @@ In this option, the idea is that the host simply uses the `authorized_keys` that | |
| sudo chmod +x /usr/local/bin/gitea | ||
| ``` | ||
|
|
||
| - For Gitea v1.15.x and earlier. As an administrative user on the host run: | ||
|
|
||
| ```bash | ||
| cat <<"EOF" | sudo tee /app/gitea/gitea | ||
| #!/bin/sh | ||
| ssh -p 2222 -o StrictHostKeyChecking=no [email protected] "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@" | ||
| EOF | ||
| sudo chmod +x /app/gitea/gitea | ||
| ``` | ||
|
|
||
| Here is a detailed explanation what is happening when a SSH request is made: | ||
|
|
||
| 1. The client adds their SSH public key to Gitea using the webpage. | ||
|
|
@@ -431,7 +421,7 @@ Never add the `Gitea Host Key` as a SSH key to a user on the Gitea interface. | |
|
|
||
| In this option, the idea is that the host simply uses the `authorized_keys` that gitea creates but at step 8 above we change the shell that the host runs to ssh directly into the docker and then run the shell there. This means that the `gitea` that is then run is the real docker `gitea`. | ||
|
|
||
| - In this case we setup as per SSHing Shim except instead of creating `/usr/local/bin/gitea` or `/app/gitea/gitea` | ||
| - In this case we setup as per SSHing Shim except instead of creating `/usr/local/bin/gitea` | ||
| we create a new shell for the git user. As an administrative user on the host run: | ||
|
|
||
| ```bash | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -301,7 +301,7 @@ volumes: | |
| sudo -u git ssh-keygen -t rsa -b 4096 -C "Gitea Host Key" | ||
| ``` | ||
|
|
||
| 在下一步中,需要在主机上创建一个名为 `/app/gitea/gitea` 的文件(具有可执行权限)。该文件将发出从主机到容器的 SSH 转发。将以下内容添加到 `/app/gitea/gitea`: | ||
| 在下一步中,需要在主机上创建一个名为 `/user/local/bin/gitea` 的文件(具有可执行权限)。该文件将发出从主机到容器的 SSH 转发。将以下内容添加到 `/user/local/bin`: | ||
|
|
||
| ```bash | ||
| ssh -p 2222 -o StrictHostKeyChecking=no [email protected] "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@" | ||
|
|
@@ -324,14 +324,14 @@ ports: | |
| ssh-rsa <Gitea Host Key> | ||
|
|
||
| # other keys from users | ||
| command="/app/gitea/gitea --config=/data/gitea/conf/app.ini serv key-1",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty <user pubkey> | ||
| command="/user/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-1",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty <user pubkey> | ||
| ``` | ||
|
|
||
| 这是详细的说明,当发出 SSH 请求时会发生什么: | ||
|
|
||
| 1. 使用 `git` 用户向主机发出 SSH 请求,例如 `git clone git@domain:user/repo.git`。 | ||
| 2. 在 `/home/git/.ssh/authorized_keys` 中,该命令执行 `/app/gitea/gitea` 脚本。 | ||
| 3. `/app/gitea/gitea` 将 SSH 请求转发到端口 2222,该端口已映射到容器的 SSH 端口(22)。 | ||
| 2. 在 `/home/git/.ssh/authorized_keys` 中,该命令执行 `/user/local/bin/gitea` 脚本。 | ||
| 3. `/user/local/bin/gitea` 将 SSH 请求转发到端口 2222,该端口已映射到容器的 SSH 端口(22)。 | ||
| 4. 由于 `/home/git/.ssh/authorized_keys` 中存在 `git` 用户的公钥,因此身份验证主机 → 容器成功,并且 SSH 请求转发到在 docker 容器中运行的 Gitea。 | ||
|
|
||
| 如果在 Gitea Web 界面中添加了新的 SSH 密钥,它将以与现有密钥相同的方式附加到 `.ssh/authorized_keys` 中。 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.